Trojan.Win32.Dropper.Gen

[MrCharlie]

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[deusgrego]

On first run I got a runtime error. After booting into safemode, it said I had the latest version and please update to the latest version? Wierd. It allowed to update the mbam version but wouldn't allow for updating the definitions. Booted back into regular mode. MBAM opened and definitions updated fine.

mbam-log-2012-07-14 (16-22-43).txt

[deusgrego]

Programs that ran before still arent running without being in safemode. I haven't yet recieved any warnings from avast about the Dropper.gen virus.

[MrCharlie]

I'm running out of ideas here, lets see if these logs shows anything:

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

[deusgrego]

Tried downloading both. Symantec blocks them as virus'. Puts it into quarantine. Labels risk as WS.Viral.1. Disable symantec?

[MrCharlie]

Yes, disable it, MrC

[deusgrego]

OTL logs

Extras.Txt

OTL.Txt

[MrCharlie]

Not much showing, lets clear out the temp files.....

Please do this:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  
  :Commands
  [EMPTYJAVA] 
  [emptytemp]
  

  
  

• Then click the Run Fix button at the top
  
• Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  
• Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
  

MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[Maurice Naggar]

Re-opened per member request.

[deusgrego]

Sorry for the delay, I was called to the field short notice to be medic for a training exercise. Attached the log for OTL run fix and also run scan afterwards.

07192012_171356.log

Extras.Txt

OTL.Txt

[MrCharlie]

OK, the temp files were deleted....good.

Now I just noticed that you have 2 anti-virus programs installed:

Avast and Symantec, is this correct?? MrC

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Symantec Endpoint Protection *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Symantec Endpoint Protection *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Symantec Endpoint Protection *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

[deusgrego]

yes that is correct

[MrCharlie]

You can't do that, choose one to keep and uninstall the other.

I suggest you keep Avast and uninstall Symantec, but it's up to you.

MrC

[deusgrego]

Symantec removed. Programs that wouldn't run now are.

[MrCharlie]

Great MrC

[deusgrego]

I think we may be able to close the thread. 2 days and avast hasn't popped up saying the virus is there. I understand symantec not allowing the programs to run correctly, but causing avast to show a virus and creating files I don't quite get. I'm hoping one of the programs you had me run got rid of it but problems continued due to symantec.

[MrCharlie]

Great

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!